Stripe Service Providers (Sub-Processors)

This document lists the outside companies Stripe uses to help run its services and explains what data goes to each one, where it is processed, and why. If Stripe adds a new company to the list that will process your data as a Business User, you have 30 days to object in writing — if you do nothing, Stripe treats that as your acceptance. All of these companies are only permitted to use your data to provide services to Stripe, not for their own purposes.

This document establishes Stripe's sub-processor disclosure framework, identifying the third-party service providers to which Stripe routes Business User, End Customer, Representative, and Visitor data, along with the data categories, geographic locations, and processing purposes for each. It sets out a time-limited objection right: Business Users may object in writing to a newly listed sub-processor within 30 days of the sub-processor page being updated, and inaction within that window constitutes deemed acceptance of the appointment. Sub-processors are contractually restricted to processing personal data solely for the purpose of providing services to Stripe and in accordance with Stripe's commitments to Business Users and applicable data protection laws. Regulatory data localization obligations require Stripe India Private Limited to store certain Indian payment transaction data on servers located in India, and Stripe Technology Company Limited in Ireland is identified as the data controller with primary responsibility for Personal Data processed outside the Americas.

As a Business User, the most direct effect of this document is the 30-day objection window: when Stripe updates its sub-processor page to add a new sub-processor that will process your data, you may object in writing within 30 days, and failure to do so is treated as acceptance of that appointment. Your data — along with End Customer and Visitor data — is shared with providers for purposes including sanctions screening (Ekata, Inc.), merchant monitoring (LegitScript, LLC), card printing (Idemia America Corp., receiving full card numbers and CVVs), AI-assisted support operations (Microsoft Corporation), and general infrastructure and site services (Google LLC, Amazon Internet Services Private Limited). All sub-processors are contractually limited to processing your data only to provide services to Stripe.